--- a/sys/crypto/chachapoly.c
+++ b/sys/crypto/chachapoly.c
@@ -351,7 +351,14 @@
 		ret = _chacha20poly1305_final(ctx, block, block, len) ?
 		      0 : EBADMSG;
 	}
-	m_copyback(m, off, len, block);
+	/*
+	 * Only write the (possibly decrypted) tail block back once the
+	 * tag has verified; otherwise we would store unauthenticated
+	 * plaintext in the mbuf even though we are about to report
+	 * EBADMSG.
+	 */
+	if (ret == 0)
+		m_copyback(m, off, len, block);
 
 	return (ret);
 }